Skip to content

Helm: admit read-only harness MCP clients #19

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
huronat wants to merge 1 commit into
base: main
Choose a base branch
from
+9 −1
Open

Helm: admit read-only harness MCP clients #19

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -267,7 +267,9 @@ CIDR configuration is capped at 64 ranges and rejects IPv4 prefixes broader
than `/12` or IPv6 prefixes broader than `/32`, including split-default-route
combinations. The Service remains cluster-internal, and its default ingress
accepts only same-namespace pods labeled
`synty.superlinked.com/mcp-client: "true"`.
`synty.superlinked.com/mcp-client: "true"`. The `sie-gw-cfg` values additionally
admit that label from the `sie-harness` namespace; both selectors must match, so
other namespaces and unlabeled harness pods remain denied.
Size persistent storage for the raw corpus plus both the current and staged
immutable build. Chart-created PVCs carry Helm's `keep` policy so an upgrade
cannot discard the corpus; use `persistence.existingClaim` when a cluster's
Expand Down
6 changes: 6 additions & 0 deletions deploy/helm/synty/values-sie-gw-cfg.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,12 @@ networkPolicy:
- podSelector:
matchLabels:
synty.superlinked.com/mcp-client: "true"
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: sie-harness
podSelector:
matchLabels:
synty.superlinked.com/mcp-client: "true"
Comment on lines +49 to +54

@coderabbitai coderabbitai Bot Jul 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

The policy remains broader than a harness-only ingress restriction.

The existing same-namespace labeled-pod peer is still ORed with the new sie-harness peer. Remove the original peer if the service must accept traffic exclusively from labeled sie-harness pods, then update the README accordingly.

  • deploy/helm/synty/values-sie-gw-cfg.yaml#L49-L54: replace the existing same-namespace peer instead of adding a second peer.
  • README.md#L270-L272: document harness-only admission after the policy is narrowed.
📍 Affects 2 files
  • deploy/helm/synty/values-sie-gw-cfg.yaml#L49-L54 (this comment)
  • README.md#L270-L272
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@deploy/helm/synty/values-sie-gw-cfg.yaml` around lines 49 - 54, Replace the
original same-namespace labeled-pod peer in
deploy/helm/synty/values-sie-gw-cfg.yaml lines 49-54 with the sie-harness
namespaceSelector so ingress is limited exclusively to labeled harness pods.
Update README.md lines 270-272 to document the harness-only admission behavior.

# AWS's published S3 prefixes for us-west-2. Refresh from ip-ranges.json when
# AWS announces a range change; the MCP pod otherwise fails closed.
objectStoreCidrs:
Expand Down
Loading